Dria

Description

The protocol performs token transfers without checking the return value or using safe transfer methods. According to the ERC20 specification, the transfer() function "SHOULD throw if the message caller's account balance does not have enough tokens to spend." However, this is only a recommendation ("SHOULD"), not a requirement ("MUST"). Therefore, even fully compliant ERC20 tokens may choose not to revert on failed transfers, instead returning false.

This design choice in the ERC20 standard means that any token, whether compliant or not, could potentially return false instead of reverting on failed transfers. Notable examples include USDT, which is widely used but returns false on transfer failures. When using regular transfer() calls with such tokens, the transaction will appear successful even though the tokens were not actually transferred.

This creates significant risks:

1. Silent failures leading to loss of funds

2. Inconsistent internal accounting states in the registry

3. Disruption of oracle services due to unprocessed payments

4. Protocol functionality breaking when integrated with compliant tokens that don't revert

The issue affects all token transfer operations in the protocol, potentially compromising both the financial integrity and operational reliability of the oracle system.

Recommendation

Implement proper transfer success validation using OpenZeppelin's SafeERC20 library, which handles both reverting and non-reverting tokens correctly.